/usr/bin/nsupdate --help — Chainguard OS Manuals

From bind-tools 9.20.30-r1 (os), captured 2026-11-05 by running nsupdate --help (exit 1). permalink

/usr/bin/nsupdate: illegal option -- -
/usr/bin/nsupdate: invalid argument --
usage: nsupdate [-CdDi] [-L level] [-l] [-g | -o | -y keyname:secret | -k keyfile] [-p port] [ -S [-K tlskeyfile] [-E tlscertfile] [-A tlscafile] [-H tlshostname] [-O] ] [-v] [-V] [-P] [-T] [-4 | -6] [filename]

Options (25)

Option	Description	Source
`-4`	This option sets use of IPv4 only.	man
`-6`	This option sets use of IPv6 only.	man
`-A` tlscafile	This option specifies the file of the certificate authorities (CA) certificates (in PEM format) in order to verify the remote server TLS certificate when using DNS-over-TLS (DoT), to achieve Strict…	man
`-C`	Overrides the default resolv.conf file.	man
`-d`	This option sets debug mode, which provides tracing information about the update requests that are made and the replies received from the name server.	man
`-D`	This option sets extra debug mode.	man
`-E` tlscertfile	This option sets the certificate(s) file for authentication for the DNS-over-TLS (DoT) transport to the remote server.	man
`-g`	This option enables standard GSS-TSIG mode.	man
`-H` tlshostname	This option makes nsupdate use the provided hostname during remote server TLS certificate verification.	man
`-i`	This option forces interactive mode, even when standard input is not a terminal.	man
`-k` keyfile	This option indicates the file containing the TSIG authentication key.	man
`-K` tlskeyfile	This option sets the key file for authenticated encryption for the DNS-over-TLS (DoT) transport with the remote server.	man
`-l`	This option sets local-host only mode, which sets the server address to localhost (disabling the server so that the server address cannot be overridden).	man
`-L` level	This option sets the logging debug level.	man
`-o`	This option is deprecated.	man
`-O`	This option enables Opportunistic TLS.	man
`-p` port	This option sets the port to use for connections to a name server.	man
`-P`	This option prints the list of private BIND-specific resource record types whose format is understood by nsupdate.	man
`-r` udpretries	This option sets the number of UDP retries.	man
`-S`	This option indicates whether to use DNS-over-TLS (DoT) when querying name servers specified by server servername port syntax in the input file, and the primary server discovered through a SOA…	man
`-t` timeout	This option sets the maximum time an update request can take before it is aborted.	man
`-T`	This option prints the list of IANA standard resource record types whose format is understood by nsupdate.	man
`-u` udptimeout	This option sets the UDP retry interval.	man
`-v`	This option specifies that TCP should be used even for small update requests.	man
`-V`	This option prints the version number and exits.	man

Examples (2) from the manual page, untested

nsupdate
The examples below show how nsupdate can be used to insert and delete resource records from the example.com zone.
nsupdate
Any A records for oldhost.example.com are deleted, and an A record for newhost.example.com with IP address 172.16.1.1 is added.

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.